Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 05:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe
-
Size
70KB
-
MD5
a22f9d5be4e32f732e992ca4203c0dbe
-
SHA1
571a03af89321b135f0c7e9b8fa0d607a4666db2
-
SHA256
6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143
-
SHA512
44b08cc30be2ee1f69a3bd1e27dbc99a699401b145610171cabb61843e838306145e09f0ec645566d9dc02d79f435e00f3e4fb0323efdfd35663c1497bee68e2
-
SSDEEP
768:GgT2ljlL5b+nXLpXwnslmxtOsoI8A+D1dykKsWkgkLuFaxGnzuUjfwVi+3NdKAGG:Grj95b+nKbIs78JChsJg6PGKUzYQ5u
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3196 Logo1_.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\legal\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\host\fxr\8.0.2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\text_renderer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\20901F2F-BFEB-4046-A198-1FE1537C16B7\root\vfs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\_desktop.ini Logo1_.exe File created C:\Program Files\MSBuild\Microsoft\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\fxr\6.0.27\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\management\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe File created C:\Windows\Logo1_.exe 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 1088 3196 WerFault.exe 85 376 3196 WerFault.exe 85 -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe 3196 Logo1_.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4668 wrote to memory of 968 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 84 PID 4668 wrote to memory of 968 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 84 PID 4668 wrote to memory of 968 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 84 PID 4668 wrote to memory of 3196 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 85 PID 4668 wrote to memory of 3196 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 85 PID 4668 wrote to memory of 3196 4668 6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe 85 PID 3196 wrote to memory of 624 3196 Logo1_.exe 87 PID 3196 wrote to memory of 624 3196 Logo1_.exe 87 PID 3196 wrote to memory of 624 3196 Logo1_.exe 87 PID 624 wrote to memory of 4872 624 net.exe 89 PID 624 wrote to memory of 4872 624 net.exe 89 PID 624 wrote to memory of 4872 624 net.exe 89 PID 3196 wrote to memory of 3484 3196 Logo1_.exe 56 PID 3196 wrote to memory of 3484 3196 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe"C:\Users\Admin\AppData\Local\Temp\6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1F6.bat3⤵PID:968
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4872
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 9684⤵
- Program crash
PID:1088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 6964⤵
- Program crash
PID:376
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3196 -ip 31961⤵PID:2044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3196 -ip 31961⤵PID:1972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD5f1fa9a5ce0eb8e38f4bde465e75f35bf
SHA178f54cc09913ed32ed899d0afe79fb25edc17b3f
SHA25616d06dc0b6d4fac408a00a90cde132a6d29ad5b05a9987b3d190cc135e4b316b
SHA512bfad13b15fc7fea6f48d46111951def32a9df80f469287c1da7c1c413a1987de6c6ba139088180dfa6250a455825651304f542f0feecd9af75f0143068138724
-
Filesize
722B
MD5db317bc2853b67b58c8d7a1b39e236d5
SHA11fc4b51a64176c4fd1f373e2533957cd74ba2e11
SHA2569f9a73e31a73cc42ba730ae2bc445fa20f52b50acf76e899842c955a4cf78a02
SHA512ab6723d22c413cd3f85c731bd8e2295f218ddbe03be8a295d58115e3c2cf4bc72d87eb63865feb3af46fc45dbe86dde58f41f1380f65e512d3a97bde17c4e6b5
-
C:\Users\Admin\AppData\Local\Temp\6ee1ea407cfbaf4c4dc8e3134d6358fc781b1058552b155da93324ab83a2a143.exe.exe
Filesize26KB
MD5af10e9952143f273218967724d665e15
SHA1281d6ede486e99e893057239a66e004d882280f9
SHA2569dc677eca507d541abd4b78154bf672bfa6561a68eea7f569849860cc5ef2ab7
SHA51253b07097d547f55e2d454324812601ce87d6400b3afe278ddd62c63e2ebe90c750785aa17e45b05f3e4a358c90ab64657fecdce667a4d2c1a07062861976581e
-
Filesize
44KB
MD59dc9ea2a5ed74b7cccf92b53dd855a28
SHA19d6026f42e278cc153851b5ec7c61629d8682f46
SHA25669bdd3f404195624d37359b90c4cef8bab73a3e6f875a8d151342626c684db6b
SHA512518f499675639c8767118ea062d8bfa330d42225764fd6cb7492fa9380405bea2dc9d777fdf9a0d2fa848e5eae7253ef8221f7e7b4d33898cd1e441003197a64
-
Filesize
9B
MD527729a3995958245e2d6799df42e26e7
SHA1dfe386f53277c8387b50122f3fda9bc2467815ba
SHA2569313041e89d4585b2606afa4809b101e7e8a2c944d063a28c796b0c0f070b5f1
SHA512ba9157cea7ca5c01b52e2a4a758f4e12e018990e49f1ece5fa6d83423f37a0a4dd5246d9b01e5e212d5e8c36a66a8d0e2645bc73753671295965a855a5028ec6